Detection, assessment and mitigation of vulnerabilities in open source dependencies